IBM Security Bulletin: IBM Security Key Lifecycle Manager Uses Hard-coded Credentials (CVE-2018-1742)

Oct 5, 2018 9:01 am EDT

Categorized: Medium Severity

Share this post:

IBMSecurity Key Lifecycle Manager contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

CVE(s): CVE-2018-1742

Affected product(s) and affected version(s):

IBM Security Key Lifecycle Manager v2.6 – 2.6.0.4

IBM Security Key Lifecycle Manager: v2.7 – 2.7.0.3

IBM Security Key Lifecycle Manager: v3.0- 3.0.0.1

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://www.ibm.com/support/docview.wss?uid=ibm10733419
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/148421

from IBM Product Security Incident Response Team https://ift.tt/2ID5vk2